PT-2024-4425 · Pypi+9 · Pymongo+9

Steve Silvester · Published 2024-06-05 · Updated 2026-04-24 · CVE-2024-5629

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions PyMongo versions 4.6.2 and earlier

Description The issue is related to an out-of-bounds read in the 'bson' module, allowing deserialization of malformed BSON provided by a server. This can lead to an exception that may contain arbitrary application memory, potentially revealing confidential information or causing a denial of service.

Recommendations For PyMongo versions 4.6.2 and earlier, update to version 4.6.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the 'bson' module until a patch is available.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2025:8419

ALT-PU-2025-10173

AZL-42682

AZL-42726

BDU:2024-04925

CESA-2025_8419

CVE-2024-5629

DLA-3832-1

DLA-3889-1

GHSA-M87M-MMVP-V9QM

GHSA-PP84-V3MW-GG4W

INFSA-2025_8419

RHSA-2025:8419

RHSA-2025_8419

USN-6904-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Pymongo

Red Hat

Red Os

Rocky Linux

Ubuntu

References · 41

• https://osv.dev/vulnerability/CVE-2024-5629 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04925 · Security Note
• https://linux.oracle.com/errata/ELSA-2025-8419.html · Vendor Advisory
• https://osv.dev/vulnerability/AZL-42726 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-5629 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2025-8419.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2025:8419 · Vendor Advisory
• https://jira.mongodb.org/browse/PYTHON-4305 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-5629 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1681 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2024-5629 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m87m-mmvp-v9qm · Vendor Advisory
• https://osv.dev/vulnerability/USN-6904-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-5629 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pp84-v3mw-gg4w · Vendor Advisory